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Welcome to the Oregon FBI’s Tech Tuesday segment. Today: Building a digital 
defense against smart home swatting attacks. 


Nationally, smart home device manufacturers have notified law enforcement that 
offenders have been using stolen email passwords to access smart devices with 
cameras and voice capabilities to carry out swatting attacks. 


What is Swatting? 


Swatting is a term used to describe a hoax call made to emergency services, 
typically reporting an immediate threat to human life. The goal is to draw a response 
from law enforcement and the SWAT team to a specific location. Confusion on the 
part of homeowners or responding officers has resulted in health-related or violent 
consequences in some other parts of the country. These attacks also pull limited 
resources away from valid emergencies. Swatting may be motivated by revenge, 
used as a form of harassment, or used as a prank, but it is a serious crime that may 
have potentially deadly consequences. Offenders often use spoofing technology to 
anonymize their own phone numbers to make it appear to first responders as if the 
emergency call is coming from the victim’s phone number. This enhances their 
credibility when communicating with dispatchers. 


How is this version of Swatting carried out? 


Recently, offenders have been using victims’ smart devices to carry out swatting 
attacks. To gain access to the devices, offenders are likely taking advantage of 
customers who reuse their email passwords for their smart device. The offenders 
use stolen email passwords to log into the device and hijack features, including the 
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live-stream camera and device speakers. They then call emergency services to 
report a crime at the victim’s residence. As law enforcement responds to the 
residence, the offender watches the live stream footage and engages with the 
responding police through the camera and speakers. In some cases, the offender 
also livestreams the incident on shared online community platforms. 


Protection and Defense 


If you have smart home devices with cameras and/or voice options, there are a few 
basic ways to protect yourself: 


= Use complex passwords or passphrases for online accounts, and don’t reuse 
passwords across different accounts. 

= Use multi-factor authentication (MFA) for all online accounts and any device 
that touches the Internet. Best bet—don’t use a secondary email address for 
that secondary layer of authentication. Use a mobile phone number, virtual or 
physical tokens, or biometric options (Such as a face or fingerprint scan). 


Next week, we will talk more about how to create strong passphrases without driving 
yourself crazy. 


If you have been victimized in this kind of crime, make sure to file a report with your 
local police department. If you believe your email or other smart device credentials 
were compromised, you should also report the incident to the FBI’s Internet Crime 
Center at www.ic3.gov or call your FBI local office. 


2 von 3 20.09.21, 08:12 


FBI Oregon Tech Tuesday: Building a Digital Defense A... 


3 von 3 


st 
inted 


Most 
nted 
jitives 
rorism 


nappings 
ssing 
sons 


aking 
rmation 


1k 
ybers 


AP 
AP 


ATA 
K% 
{4 
0 
uN 
we) 
o Kt e 
at 





tructure 
tnerships 


nmunity 
reach 


Qs 


FBt 


News 


Stories 
Videos 


Press 
Release 


Speeches 
Testimony 


Podcasts 
and Radio 


Photos 
Español 


Apps 


Resources 


Law 
Enforcement 


of. FEDERAtsBIOREAU 
OF INVESTIGATION 


Victim 
Assistance 


Reports & 
Publications 


What We 
Investigate 


Terrorism 
Counterintelligence 
Cyber Crime 
Public Corruption 
Civil Rights 
Organized Crime 
White-Collar Crime 
Violent Crime 


WMD 


Contact Us 


Field Offices 


FBI Headquarters 


Services 


CJIS 
CIRG 


Laboratory 
Services 


Training 
Academy 


Operational 
Technology 


Information 
Management 


FBI Jobs 


Submit a Tip 


Crime 
Statistics 


Hnstory 


FBIgbv Contact C 


Scams & 
Safety 


FBI Kids 
FBI Tour 


https://www.fbi.gov/contact-us/field-offices/portland/ne... 


Addition: 
Resourc: 


Accessibil 
eRulemak 


Freedom 
Informatio 
Privacy A\ 


Legal 
Notices 


Legal 
Policies & 
Disclaime 


Privacy 
Policy 


USA.gov 
White Hot 


No-FEAR 
Act 


Equal 


tekuni 


Email updates 


20.09.21, 08:12 


